Product evidence

Case Files

Real open-source findings, regression replays, and proposed Fix PRs, with supporting evidence and review status.

Pydantic AIP1Security vulnerabilityFix PR

In the code: 1 yr
Stable releases affected: 189
Report to fix: 5 days

Disclosed privately · Fixed upstream

Early Found a Credential Leak. Pydantic Shipped the Fix.

Early uncovered a year-old security defect, created a fix with a test, and reported it privately. Pydantic confirmed the issue and released a broader fix.

Read the Case File

PHPP1Security vulnerabilityFix PR

Introduced: 2025
Before disclosure: 21 mo
Fix PR: Yes

Single-commit historical replay5bf6e2e → 0a14ab1

PHP2Shell: Early flagged the defect in the change that introduced it

Early flagged the unsafe memory lifetime, then created a Fix PR on the vulnerable revision.

Read the Case File

Pydantic AIP2BugFix PR

Finding: BUG
Changed files: 4
Fix PR: Created

PR created on Early's fork · Not merged

Pydantic AI: From Finding to Fix PR

Early identified a saved-state bug in Pydantic AI, then generated a repair and test after user initiation. Follow the product flow into draft Fix PR #3.

Read the Case File

MastraRegression

Expected changes: 10
Regression: 1
Time to fix: 247hours

3 releases affected1.56.0 → 1.59.0

A Persistence Fix Skipped Final Processors

Failed turns could bypass output handling and persistence behavior configured for the stream.

Read the Case File

ConanRegression

Expected changes: 8
Regression: 1
Time to fix: ~20hours

1 release affected2.31.0 → 2.31.1

A Valid No-Op Became a Build Failure

A valid no-op replacement could raise a false pattern-not-found exception and stop a Conan recipe build.

Read the Case File

Pydantic AIRegression

Expected changes: 5
Regression: 1
Time to fix: 28days

14 releases affectedv1.92.0 → v1.106.0

A Pydantic AI Regression Inside a 47-File Fix

A streaming handler that returned early could leave an agent run with an incomplete or empty response.

Read the Case File

RspackRegression

Expected changes: 4
Regression: 1
Time to fix: ~18hours

1 release affectedv2.1.0 → v2.1.1

The Build Passed. The Import Failed.

Production optimization could remove a valid CommonJS default export, causing consumers' default imports to resolve to undefined at runtime.

Read the Case File

Expected changes: 6
Regression: 1
Time to fix: 12days

3 releases affectedv4.12.28 → v4.12.31

A Valid Form Request Returned Corrupted Fields

A valid form request could fail with HTTP 500 or return HTTP 200 with corrupted fields.

Read the Case File

From code change to evidence

1
Select
Choose a release window or historical commit.
2
Analyze
Run Early and review the findings.
3
Inspect
Examine the code and supporting evidence.
4
Document
Show the finding, any Fix PR, and verification status.

Remember your last regression? Let Early trace it.

Use a release your team already understands to evaluate what Early finds.

[Pilot with Early]